From 5ae8c56f2af2c114b63f36890f55eb028b4319c3 Mon Sep 17 00:00:00 2001 From: Lior Poterman <191881919+cx-lior-poterman@users.noreply.github.com> Date: Mon, 31 Aug 2026 12:38:07 +0300 Subject: [PATCH] fix(ci): gate release and package-deletion jobs behind release environment Both the release job and the delete-packages-and-releases job could run without any approval gate, even though the destructive delete workflow is directly dispatchable and is also invoked by release.yml. Adding `environment: release` to each job routes them through the existing `release` GitHub Environment, which already has required reviewers and a branch policy configured. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/delete-packages-and-releases.yml | 1 + .github/workflows/release.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/.github/workflows/delete-packages-and-releases.yml b/.github/workflows/delete-packages-and-releases.yml index b1c57c28..e0f97555 100644 --- a/.github/workflows/delete-packages-and-releases.yml +++ b/.github/workflows/delete-packages-and-releases.yml @@ -23,6 +23,7 @@ permissions: jobs: delete: name: Delete packages and releases + environment: release permissions: contents: write # for gh release delete and tag cleanup packages: write # for deleting npm package versions diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 310db7e1..99e149fd 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -63,6 +63,7 @@ jobs: if: inputs.dev == true release: name: Release + environment: release permissions: id-token: write # allows this job to request a GitHub OIDC token contents: write # for git tag push and creating the GitHub release